1. Analysis and Detection of Access Violations in Componentised Systems David Llewellyn-Jones, Madjid Merabti, Qi Shi, Bob Askwith Advances in Computer Security and Forensics – 13 th July 2007 Network & Information Security Technology Laboratory School of Computing and Mathematical Sciences Liverpool John Moores University Byrom Street, Liverpool L3 3AF, UK Email: {D.Llewellyn-Jones, M.Merabti, Q.Shi, R.Askwith}@ljmu.ac.uk Web: http://www.cms.livjm.ac.uk/NISTL

2. Contents Introduction –Access control –Ubiquitous computing –Network elevation of privileges Composition access control check –Process –Implementation Experiments and results Conclusion

3. Access Control In theory –User can access data only if their access level satisfies the access requirements of the data In practice –A user can only access data via a program User Data Access level Access req. User Program Access level Access req. DataAccess req. Access level

4. Distributed Access Control Taos, local access control –Centralised access control DSS DACS, DSI, CORBASec –Atomic –Enforced between pairs of components An alternative approach –Consider wider composition structure

5. Ubiquitous Computing Networking is wireless and pervasive Devices are mobile and plentiful Data flows unimpeded –Easy access to data from anywhere –Access control remains important

6. Data sent across a network may be vulnerable –Inconsistent access requirements –Each system individually satisfies access requirements –Combined, incorrect access may occur Network Elevation of Privileges System BSystem A Alice’s file Alice’s program File with access by Bob Bob’s program SU’s program File Bob’s program read write read send

7. Solution Overview Analyse possible data flow through a network –Based on topology and component properties –Analysis takes place when topology changes –Access control requirements are checked –Composition only allowed if requirements met Need to know –Connections (data flow) between components –Data flow within each component

8. Formalisation Each component defined 4 data structures –u R, u W  U, effective user ID for read, write –d R, d W  D, access of files read, written by component Access mappings –f R, f W : U × D → {0, 1}, determines if read, write access should be granted Example: read access control lists d R =Aliceu R =Bob f R (u R, d R ) = 1 if u R  d R Bob0 otherwise Fred

9. Connections Between Components Follow data flow through components –For example, simple depth first traversal Match data access requirements with component access levels –Maintain d R, d W of data accessed, compare with u R, u W for each component using f R, f W. 12 3 54 25 1 3 4

10. Component Slicing Data flow within each component –Use Slicing to follow data –Applied using pre and post conditions

11. Structure Projection Follow data flow through components –Take internal data flow into account –Use slicing to determine this Project the structure –Project connections onto points –Join points if pairs of connections coincide 12 3 54 3 4 5 2 1 3

12. Current Implementation Use MATTS component analysis tool –Based on agent components –Performs automatic slicing and topology check –Currently must input connections manually

13. Future Implementation To exist as a service in the network –Properties determined using instrumentation Recheck whenever topology changes –Failure means composition would be refused –Success means access control requirements are guaranteed to be fulfilled –Properties cached to reduce overhead

14. Timing Results Chain of components –Analysed as a single application –Analysed using composition analysis 600 MHz Intel X-Scale 80321 Processor

15. Conclusion Provides useful distributed access control checking technique Implementation suggests practical solution –Intend to implement in a Networked Appliance setting Highlights how composition analysis can reduce impact of state explosion